CVE-2025-55182-zoomeye - 🔍 Next.js RCE Scanner (CVE-2025-55182) - Automated

项目说明

Zoomeye Next.js RCE Scanner

Author: im-ezboy

Scanner for Next.js RCE (C) using Zoomeye search. Finds targets queries and tests them with the supplied exploit payload.

Features

Two focused Zoomeye dorks by default:

- http.header="Vary: RSC, Next-Router-State-Tree"
- vul.cve="C"

Parallel scanning (default 20 threads) with request timeout control.

Sa targets to *.txt and a detailed JSON report.

Console output highlights targets with separators for readability.

User-specified max total results (capped at 500,000) to manage scope.

Requirements

Python 3.8+

Dependencies: requests, tqdm

Install deps:

Configuration

Edit zoomeye.py:

ZOOMEYE_API_KEY – put your Zoomeye API key here (remove it before pushing to public repos).

Optional: ZOOMEYE_USERNAME, ZOOMEYE_PASSWORD if you prefer JWT login (lea for API key).

RESULTS_PER_QUERY (default 1000) and MAX_PAGES (default 200) – pagination controls; subject to your plan limits.

MAX_TOTAL_LIMIT (default 500_000) – hard cap for user-requested total results.

SCAN_THREADS (default 20) and REQUEST_TIMEOUT (default 10s) – tuning knobs for scanning speed .

Usage

You will be prompted for the total results limit (<= 500000). Press Enter to use the default (RESULTS_PER_QUERY * 2).

Example:

Output

Console:

- Section separators (============================) for each stage.
- If are found, they are listed in red with indices.

Files:

- MDD_HHMMSS.txt – targets (one per line).
- report_zoomeye_YYYYMMDD_HHMMSS.json – summary and metadata.

Safety & Limits

Large limits may hit Zoomeye rate limits or plan caps; adjust RESULTS_PER_QUERY, MAX_PAGES, and the prompted total limit accordingly.

The exploit payload is for C; use responsibly and only on targets you are permitted to test.

项目信息

开发语言：Python

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🔍 Next.js RCE Scanner (CVE-2025-55182) - Automated vulnerability scanner using Zoomeye search engine. Discovers targets via dorks and tests for CVE-2025-55182 with parallel scanning capabilities.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	CVE-2025-55182-zoomeye - 🔍 Next.js RCE Scanner (CVE-2025-55182) - Automated
所属分类	安全软件
发布作者	admin
发布时间	2026-10-05 23:05:17
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	198
讨论数量	0
主题状态	正常讨论中